| 标题 | NousResearch hermes-agent 0.16.0 Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) |
|---|
| 描述 | # Technical Details
A private-network policy bypass exists in the browser tooling of `tools/browser_tool.py` in hermes-agent.
Hermes correctly blocks direct navigation to private/internal URLs via `browser_navigate()` using `_is_safe_url()` and `_allow_private_urls()` checks. However, `browser_console()` accepts an `expression` parameter and routes it to `_browser_eval()`, which executes attacker-controlled JavaScript in the active page context. This JavaScript can set `location.href` to a loopback or internal target, and `_browser_eval()` does not validate whether the main-frame URL changed to a private destination. Subsequent `browser_snapshot()` calls return the private page content without re-checking the current page URL.
# Vulnerable Code
File: tools/browser_tool.py
Method: browser_console() -> _browser_eval()
Why: `browser_console()` forwards attacker-controlled `expression` input to `_browser_eval()` which executes page-context JavaScript but does not re-validate the post-eval main-frame destination. `browser_snapshot()` then reads and returns private page content without URL re-validation.
# Reproduction
1. Configure hermes-agent with browser tooling in cloud-browser mode with private-network restrictions enabled.
2. Call `browser_navigate()` on a public page to establish a browser context.
3. Call `browser_console(expression="location.href = 'http://127.0.0.1:<port>/'; 'navigated'")`.
4. Call `browser_snapshot()`.
5. Observe private canary content in the snapshot despite direct navigation to the same URL being blocked.
# Impact
- Bypasses Hermes' private-network browser restriction policy.
- Unauthorized disclosure of localhost-only dashboards, internal web applications, dev services, and other browser-reachable private content.
- Browser-side SSRF implications wherever Hermes is deployed with cloud-browser protections. |
|---|
| 来源 | ⚠️ https://gist.github.com/YLChen-007/2e5bf7fa58113967807425032234cc89 |
|---|
| 用户 | Eric-y (UID 95889) |
|---|
| 提交 | 2026-06-12 11時44分 (2 月前) |
|---|
| 管理 | 2026-08-04 09時36分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 385785 [NousResearch hermes-agent 直到 0.16.0 Browser Tooling tools/browser_tool.py browser_snapshot 权限提升] |
|---|
| 积分 | 20 |
|---|